AWS Certified Security – Specialty732 questions across 74 pages are complete and free, with no account or card.
732 questions in this bank
Free access · progress saved on this device
A company had one of its Amazon EC2 key pairs compromised. A Security Engineer must identify which current Linux EC2 instances were deployed and used the compromised key pair. How can this task be accomplished?
Answer: A
A security engineer discovers that a company’s user passwords have no required minimum length. The company is using the following two identity providers (IdPs): • AWS Identity and Access Management (IAM) federated with on-premises Active Directory • Amazon Cognito user pools that contain the user database for an AWS Cloud application that the company developed Which combination of actions should the security engineer take to implement a required minimum length for the passwords? (Choose two.)
Answer: BC
For Amazon Cognito: You can configure password length requirements directly in Cognito user pools5 The minimum password length can be set between 6 and 99 characters, though users can set passwords up to 256 characters long5 This is configured through the Password Policy settings in the Cognito user pool5 For Active Directory (federated with IAM): Since IAM is federated with on-premises Active Directory, the password policies are managed at the Active Directory level13 Password length requirements can be configured in Active Directory through Group Policy settings13 Changes must be made in Active Directory, not IAM, since AD is the authoritative source for authentication
Source: Adapted from community discussion — youonebe
A Security Engineer for a large company is managing a data processing application used by 1,500 subsidiary companies. The parent and subsidiary companies all use AWS. The application uses TCP port 443 and runs on Amazon EC2 behind a Network Load Balancer (NLB). For compliance reasons, the application should only be accessible to the subsidiaries and should not be available on the public internet. To meet the compliance requirements for restricted access, the Engineer has received the public and private CIDR block ranges for each subsidiary. What solution should the Engineer use to implement the appropriate access restrictions for the application?
Answer: C
A company uses AWS Key Management Service (AWS KMS). During an attempt to attach an encrypted Amazon Elastic Block Store (Amazon EBS) volume to an Amazon EC2 instance, the attachment fails. The company discovers that a customer managed key has become unusable because the key material for the key was deleted. The company needs the data that is on the EBS volume. A security engineer must recommend a solution to decrypt the EBS volume’s encrypted data key. The solution must also attach the volume to the EC2 instance. Which solution will meet these requirements?
Answer: C
A company needs to analyze access logs for an Application Load Balancer (ALB). The ALB directs traffic to the company’s online login portal. The company needs to use visualizations to identify login attempts by bots from a list of known IP sources. Which solution will meet these requirements?
Answer: D
The best solution for analyzing access logs from an Application Load Balancer (ALB) and visualizing login attempts by bots from known IP sources is: D. Configure the ALB to send logs directly to an Amazon S3 bucket. Analyze the logs by using Amazon Athena. Visualize the logs by using Amazon QuickSight. Amazon S3: Storing logs in S3 is cost-effective and scalable. Amazon Athena: Allows you to run SQL queries on the log data stored in S3, making it easy to filter and analyze specific login attempts, including those from known bot IPs
Source: Adapted from community discussion — IPLogic
A company runs a cron job on an Amazon EC2 instance on a predefined schedule. The cron job calls a bash script that encrypts a 2 KB file. A security engineer creates an AWS Key Management Service (AWS KMS) customer managed key with a key policy. The key policy and the EC2 instance role have the necessary configuration for this job. Which process should the bash script use to encrypt the file?
Answer: A
A company is building a data lake on Amazon S3. The data consists of millions of small files containing sensitive information. The Security team has the following requirements for the architecture: * Data must be encrypted in transit. * Data must be encrypted at rest. * The bucket must be private, but if the bucket is accidentally made public, the data must remain confidential. Which combination of steps would meet the requirements? (Choose two.)
Answer: BC
A security engineer needs to analyze Apache web server access logs that are stored in an Amazon S3 bucket. Amazon EC2 instance web servers generated the logs. The EC2 instances have the Amazon CloudWatch agent installed and configured to report their access logs. The security engineer needs to use a query in Amazon Athena to analyze the logs. The query must identify IP addresses that have attempted and failed to access restricted web server content held at the /admin URL path. The query also must identify the URLs that the IP addresses attempted to access. Which query will meet these requirements?
Answer: A
A. SELECT client_ip, client_request FROM logs WHERE client_request LIKE ‘%/admin%’ AND server_status = ‘403’ client_ip: This field identifies the IP addresses that attempted to access the restricted content. client_request: This field shows the URLs that the IP addresses attempted to access. LIKE ‘%/admin%’: This condition filters the requests to those targeting the /admin URL path. server_status = ‘403’: This condition ensures that only failed access attempts (HTTP 403 Forbidden status) are included in the results. This query will help the security engineer identify both the IP addresses and the specific URLs they attempted to access, which is crucial for analyzing unauthorized access attempts.
Source: Adapted from community discussion — IPLogic
A Security Engineer discovered a vulnerability in an application running on Amazon ECS. The vulnerability allowed attackers to install malicious code. Analysis of the code shows it exfiltrates data on port 5353 in batches at random time intervals. While the code of the containers is being patched, how can Engineers quickly identify all compromised hosts and stop the egress of data on port 5353?
Answer: C
A company uses Amazon Cognito as an OAuth 2.0 identity platform for its web and mobile applications. The company needs to capture successful and unsuccessful login attempts. The company also needs to query the data about the login attempts. Which solution will meet these requirements?
Answer: B
AWS CloudTrail provides detailed logs of all API calls made to Amazon Cognito, including login attempts. Amazon S3 is used to store these logs, ensuring they are easily accessible and durable. Amazon Athena allows you to run SQL queries on the logs stored in S3, making it straightforward to filter and analyze the data for specific events, such as InitiateAuth, which corresponds to login attempts. This setup ensures that you can capture both successful and unsuccessful login attempts and query the data efficiently.
Source: Adapted from community discussion — Pmktechno
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
SCS-C02 practice, question 241. 732 questions available.
Version 1.0.0. How we source questions